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PREFACE 



This manual is the 68000/68010 Personality 
Hardware Supplement (KSE-5540) to the KSE 
Series Slave Emulator Hardware Reference (KSE- 
5500) and 2302 Series Slave Emulator Reference 
(2302-5003) manuals . It describes the instal- 
lation and operation of both the 68000 and 
68010 Emulator Subsystems* 

This manual is intended to be used with both 
the 2300 series ADS equipment and the KDS/KSE 
series of products. 

Though separate products , the 680 00 and 68010 
Emulator Subsystems are functionally similar. 
Where the microprocessor is referred to as 
68000/68010 , the text applies to either 
processor. Where the Emulator Subsystems 
differ f the specific microprocessor name 
(68000 or 68010) is used in the text. 
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SECTION 1 



INTRODUCTION 



The 68000/68010 Emulator Subsystem is a powerful software and 
hardware development tool that permits full speed emulation. 
Similar personality and probe boards are used for emulating the 
68000 and the 68010. 



1.1 PURPOSE MB JSCQ2E 

This supplement describes the installation and operation of the 
68000/68010 Emulator Subsystem and gives detailed information on 
logic operations of the personality board and the emulator probe. 



1.2 68QQQ/$8Q1Q PERSONALITY OVERVIEW 

The 68000/68010 emulator personality package consists of: 

1. Personality board 

2. Emulator probe 

3. Connecting cable set 

4. Emulation software 

The 68000/68010 emulator can be used with or without a target 
system. Without a target system , the emulator can be used to 
execute and debug 68000/68010 code in real time using 
breakpoints , optional bus analyzer , register display, and 
several options of memory window displays. 

With a target system, the emulator's memory can be used in place 
of target memory, in whole or in part, anywhere within the 
68000/68010 address space. The input control lines to the 
68000/68010 (interrupts, DMA) from the target can be enabled or 
disabled to isolate problems. 

The 68000/68010 emulator permits full speed emulation (at up to 
10MHz) in both the supervisor mode and the user mo'de. When the 
emulator is executing target code, it is performing full speed 
emulation. However, when a display update is requested or a 
snapshot or a breakpoint is reached, the emulation is halted. 
Then the 68000/68010 is used by the emulator to access registers 
and memory. For snapshots, execution is interrupted for an 
interval between 10 and 100 microseconds, depending on the mode 
of operation used. 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



EMULATOR PROBE & PERSONALITY BOARD 



1.2.1 PERSONALITY BOARD (2302-4744) 

Different versions of the 2302-4744 personality support the 68000 
or 68010 microprocessor • Descriptions in this manual apply 
equally to both processors f unless otherwise specified* Either 
board is plugged into the backpanel of the emulator card cage 
through connectors PI and P2« The other three edge connectors 
are used as follows: P4 and P5 connect to the probe board f and P3 
connects to the bus analyzer board through flat cables. See 
Figure S-l and Figure S-14. 



c=^^ — ^ — i__rrnnTrnTTTi__jiui»hiiiiitjiiitiiiiiii iiiiiiiiiiiitiiui imiiih__j j===::; ^^p 

1 13 1 25 1 25 

P3 P4 P5 
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43 1 38 
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Figure S-l. Personality Board 



68000/68010 SUPPLEMENT (KSE-5540-02) 



PERSONALITY BOARD & EMULATOR PROBE 



The personality board interfaces the 68000/68010 bus structure to 
the emulator bus and also controls the execution and halting of 
user code* The emulator gains control of the 68000/68010 
execution by forcing a level 7 (non-maskable) interrupt ♦ During 
the interrupt vectoring and subsequent program executions, 
special sequencing hardware selectively forces memory accesses to 
test memory (located on the personality board) • Test memory 
routines are used to manipulate 68000/68010 registers and 
memory. The personality board qualifies execution breakpoints 
and presents memory cycle data to the breakpoint and bus 
analyzer boards in a standardized form* (See section 4.) 



1.2.2 EMULATOR PROBE (2302-4780) 

The 68000/68010 emulator probe shown in Figure S-2 contains: 

* the emulation processor (either the 68000 or the 68010) 

* buffers 

* control logic 

* internal clock 




Figure S-2* 68000/68010 Emulator Probe 
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68000/68010 SUPPLEMENT (KSE-55 40-02) 



EMULATOR PROBE & SPECIFICATIONS 



Both sets of ribbon cables extending from the emulator probe 
have ground wires alternating with almost all the signal wires 
for signal isolation* The primary function of the emulator 
probe is to bring the 68000/68010 as close as possible to the 
system being emulated. In addition f the probe: 

* buffers and controls the source and the destination 
of all data for the 68000/68010 

* enables and disables external control lines 

* provides a clock source when the target clock is not 
selected for use 



1*2 .3 HARDWARE MECHANICAL SPECIFICATIONS 

Emulator probe outline dimensions: 
Width: 7.3" (18.25 cm) 
Height: 1.3" (3.25 cm) 
Length: 11.4" (28.50 cm) 
Weight: 4 lbs. (1.8 kg) 

Cable lengths: 

Emulator chassis to probe box: 72" (182.88 cm) 
Probe box to plug: 24" (60.96 cm) 



1,2.4 GROUNDING 



An important factor in promoting trouble-free emulator operation 
is a sound power and ground grid in the target system. It is 
strongly recommended that all systems have a soldered down grid 
of power and ground in the prototype. This is necessary for 
proper emulation, because signals normally going to the 
microprocessor must now travel to the emulator probe. Prototype 
systems which have wirewrapped power and ground provide a poor 
emulation environment due to high noise levels, and are likely 
to cause serious problems. 
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68000/68010 SUPPLEMENT (KSE-5540-02) 




EMULATOR 
PLUG 



EMULATOR PROBE 



Figure S-3» Buffer Circuit 



1.2.5 SIGNAL PULSE DELAYS 

Microprocessor signal specifications are commonly referenced to 
clock edges. Each signal at the emulator plug is buffered in 
both directions in the emulator probe . A signal such as AO in 
Figure S-3, delivered to the emulator plug through the buffer 
typically arrives 12-18 ns later. There is a similar signal 
delay for DO in the same figure, from the target system to the 
microprocessor. For request/response operations, such as memory 
reads, these delays are additive and can result in a total delay 
of 24 to 36 ns. 



1,2*6 EMULATOR TIMING DELAYS 

Tables S-l and S-2 contain timing delay data for the 680 00 and 
68010. The data was taken from commercial data specifications 
for the 68000 and 68010 microprocessors. A separate column 
lists emulator-added delays to manufacturer's specifications, 
where significant. Additional timing diagrams, using the same 
signal numbers for cross referencing, are shown on the page 
following Tables S-l in Figure S-4, and after Table S-2 in 
Figure S-5. 
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Table 6-1 • Timing Delays for the 68000 

All units and all emulator-added delays are nanoseconds. 
Numbers 35, 36 # 37, 39, 46 and 56 are expressed as clock periods. 









MC68000L4 


MC68000L6 


MC68000L8 


MC68000L10 


Emulator 








4 MHz 




6 MHz 




8MHz 




10 MHz 




Added Delays 


No. 


Character ist ic 


Symbol 


Min 


Max 


Min 


Max 


Min 


Max 


Min 


Max 


Min 
run 


Ma v 
rid a 


1 


Clock Period 


tcvc 


250 


500 


167 


500 


125 


500 


100 


500 






2 


Clock Width Low 


tCL 


115 


250 


75 


250 


55 


250 


45 


250 






3 


Clock Width High 


tCH 


115 


250 


75 


250 


55 


250 


45 


250 






4 


Clock Fall Time 


tCf 


— — 


10 


— 


10 


— 


10 


— 


10 






5 


Clock Rise Time 


tCr 


— 


10 


— 


10 


— >— 


10 


— 


10 








6 


Clock Low to 


























Address Valid 


tCLAV 


— — 


90 




80 




70 


m-mm. 


55 


19 


30 


6A 


Clock High to 


























rL Vailu 


ttlirLV 




90 




80 




70 




60 


23 


35 


7 


CLK High to Address 


























Data High Impedance 


tCHAZx 




120 




100 




80 




70 


19 


30 


8 


CLK High to Address/FC 


























Invalid (min.) 


tCHAZn 


0 




0 




0 




0 




23 


35 


9 


CLK High to AS*,DS* 


























Low (max.) 


tCHSLx 




80 




70 




60 




55 




48 


10 


CLK High to AS*,DS* 


























Low (min.) 


tCHSLn 


0 




0 




0 




0 




29 




11 


Add. to AS*,DS* (Read) 


























Low/AS* Write 


tAVSL 


55 




35 




30 




20 




15 


25 


11A 


FC Valid to AS*,DS* 


























(Read) Low/AS*Write 


tFCVSL 


80 




70 




60 




50 




13 


0 


12 


CLK Low to AS*,DS* High 


tCLSH 




90 




80 




70 




55 


19 


30 



^Indicates that the signal is active low. 
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Table S-l. Timing Delays for the 68000 (Continued) 



All units and all emulator-added delays are nanoseconds. 
Numbers 35, 36, 37, 39, 46 and 56 are expressed as clock periods. 









MC68000L4 


MC68000L6 


MC68000L8 


MC68000L10 


Emulc 


itor 








4 MHz 




6MHz 




8MHz 




10MHz 




Added Delays 


No. 


Characteristic 


Symbol 


Min 


Max 


Min 


Max 


Min 


Max v 


Min 


Max 


Min 


Max 


13 


AS*,DS* High to 


























Address/FC Invalid 


tSHAZ 


60 




40 




30 




20 




16 


20 


14 


AS*,DS* Width Low 


























(Read)/AS* Write 


tSL 


535 




337 




240 




195 




0 


— — 


14A 


DS* Width Low (Write) 




285 





170 





115 





95 





0 




15 


AS*,DS* Width High 


tSH 


285 


— 


180 


— 


150 


— 


105 


— 


0 




16 


CLK High to 


























AS*,DS* High Impedance 


tCHSZ 




120 




100 




80 




70 


29 


48 


17 


AS*,DS* Hi to R/W High 


tSHRH 


60 




50 




40 




20 




15 


29 


18 


CLK High to R/W* 


























High (max) 


tCHRHx 




90 




80 




70 




60 


19 


28 


19 


CLK High to R/W* 


























High (min) 


tCHRHn 


0 




0 




0 




0 




0 


0 


20 


CLK High to R/W* Low 


tCHRL 




90 




80 




70 




60 


15 


25 


21 


Add. Valid to R/W* Low 


tAVRL 


45 




25 




20 




0 




0 


0 


21A 


FC Valid to R/W* Low 


tFCVRL 


80 




70 




60 




50 




4 


5 


22 


R/W* Low to DS* Low 


























(Write) 


tRLSL 


200 




140 




80 




50 




15 


25 


23 


CLK Low to Data Out 


























Valid 


tCLDO 




90 




80 




70 




55 


19 


28 


25 


DS* High to Data Out 


























Invalid 


tSHDO 


60 




40 




30 




20 




-25 


-15 


26 


Data Out Valid to DS* 


























Low (Write) 


tDOSL 


55 




35 




30 




20 




-15 


25 



*Indicates that the signal is active low. 



Table 8-1. Timing Delays for the 68000 (End) 



All units and all emulator-added delays are nanoseconds. 
Numbers 35 r 36 # 37, 39, 46 and 56 are expressed as clock periods. 









MC68000L4 


MC68000L6 


MC68000L8 


MC68000L10 


Emulator 








4 MHz 




6MHz 




8MHz 




10MHz 




Added Delays 


No 


(""hfi rart*pri fit* i c 


Svmbol 


Min 


Max 


Min 


Max 


Min 


Max 


Min 


Max 


Min 


Max 


97 


Dafa Tn to CI.K Low 


























(Setuo Time) 


tDICL 


30 


— 


25 


— 


15 


— 


15 


— — 


-1 




28 


AS*.DS* Hiqh to 


























DTACK* High 


tSHDAH 


0 


240 


0 


160 


0 


120 


0 


90 


-41 


-20 


29 


DS* High to Data 


























Invalid (Hold Time) 


tSHDI 


0 


— — 


0 




0 


— 


0 


— 


-25 


-15 


30 


AS*,DS* High to 


























BERR* High 


tSHBEH 


0 


— — 


0 


— 


0 


— — 


0 


— 


-53 


-33 


31 


DTACK* Low to 


























Data In (Setup Time) 


tDALDI 


— 


160 


— 


120 


— 


90 % 


— 


65 


-13 


-8 


32 


HALT* and RESET* 


























Input Transition Time 


tRHrf 


o 


200 


o 


200 


o 


200 


q 


200 


0 


0 


33 


CLK High to BG* Low 


tCHGL 


0 


90 


0 


80 


0 


70 


0 


60 


19 


30 


34 


CLK High to BG* High 


tCHGH 




90 




80 




70 




60 


19 


30 


35 


BR* Low to BG* Low 


tBRLGL 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


18 


28 


36 


BR* High to BG* High 


tBRHGH 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


18 


28 


37 


BGACK* Low to BG* High 


tGALGH 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


1.5 


3.0 


18 


28 


38 


BG* Low to Bus High 


























Impedance (With AS* High)tGLZ 




120 




100 




80 




70 


15 


25 


39 


BG* Width High 


tGH 


1.5 




1.5 




1.5 




1.5 




0 


0 


46 


BGACK* Width 


tBGL 


1.5 


-1.5 


-1.5 




1.5 




0 


0 




0 


47 


Asynchronous Input 


























Setup Time 


tASI 


30 




25 




20 




20 




1 


2 


48 


BERR* Low to DTACK* Low 


tBELDAL 


50 




50 




50 




50 




1 


2 


53 


Data Hold from CLK High 


tCHDO 


0 




0 




0 




0 




19 


30 


55 


R/W* to Data Bus 


























Impedance Change 


tRLDO 


55 




35 




30 




20 




0 


0 


56 


Halt/RESET* Pulse Width 


tHRPW 


10.0 




10.0 




1.0 




10.0 




0 


0 




* Indicates that the signal is active 


low. 



















68000/68010 SUPPLEMENT (KSE-5540-02) 




Asynchronous 
Inputs 
(Note 1 ) 

HALT/ RESET 



BERR/BR 
(Note 2 ) 



DTACK 



Data In 



X 



« (66. 



<• — ► 



<47 



47 




27, 



--Hi 



< ► 



.28) * 



3— 



The circled numbers refer to Table S-l, where the same 
numbers are used to identify the signals shown in this 
timing diagram. Timing measurements are referenced to 
and from a low of 0,8 volts and a high of 2,0 volts. 

Note 1: Setup times for BGACK, IPL0-IPL2 f and VPA 
guarantee their recognition at the next falling edge of 
the clock* 

Note 2: BR must fall at this time to ensure recognition 
at the end of this bus cycle. 



Figure S-4. 68000 Read Cycle Timing 
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68000/68010 SUPPLEMENT (KSE-5540-02) 




The circled numbers refer to Table S-l, where the same 
numbers are used to identify the signals shown in this 
timing diagram* 

NOTE: Timing measurements are referenced to and from a 
low of 0.8 volts and a high of 2.0 volts. 

Figure S-5. 68000 Write Cycle Timing 
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Table S-2. Timing Delays for the 68010 



All units and all emulator-added delays are nanoseconds. 
Numbers 35 f 36, 37, 39, 46 and 56 are expressed as clock periods. 









MC68010L8 


MC68010L10 


Emulator 








8 MHz 




10MHz 




Added Delays 


Number 


Characteristic 


Symbol 


Min 


Max 


Min 


Max 


Hin 


Max 


1 


Clock Period 


tcvc 


125 


500 


100 


500 







2 


Clock Width Low 


tCL 


55 


250 


45 


250 








3 


Clock Width High 


tCH 


55 


250 


45 


250 








4 


Clock Fall Time 


tCf 




10 




10 


— — 


— — 


c 
D 


Clock Rise Time 


tCr 




10 


mmmm 


10 


' 




6 


Clock Low to 


















Address Valid 


tCLAV 


— 


70 





55 


19 


30 


6A 


Clock High to 


















FC Valid 


tCHFCV 




70 




60 


23 


35 


7 


CLK High to Address 


















Data High Impedance 


tCHAZx 




80 




70 


19 


30 


8 


CLK High to Address/FC 


















Invalid (min.) 


tCHAZn 


0 




0 




23 


35 


9 


CLK High to AS*,DS* 


















Low (max.) 


tCHSLx 




60 




55 




46 


10 


CLK High to AS*,DS* 


















Low (min.) 


tCHSLn 


0 




0 




29 




11 


Add. to AS*,DS* (Read) 


















Low/ AS* Write 


tAVSL 


30 




20 




15 


25 


11A 


FC Valid to AS*,DS* 


















(Read) Low/AS*Write 


tFCVSL 


60 




50 




-13 


0 


12 


CLK Low to AS*,DS* High 


tCLSH 




70 




55 


19 


30 ! 


*Indicates that the signal is active low. 
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Table S-2. Timing Delays for the 68010 (Continued) 



All units and all emulator-added delays are nanoseconds. 
Numbers 35, 36, 37, 39, 46 and 56 are expressed as clock periods. 









MC68010L8 


MC68010L10 


Emulator 








8 MHZ 




10 MHz 




Added Delays 


lNlilllUv* x. 


pha rripl'f* r i Fit - i r* 


fttjrjr llih-jyj X 


Min 


Max 


Min 


Max 


win 


Max 


1 ^ 

JL J 


A£*.DS* Hiah to 


















Afifi r pf? h /FP Tnvalirl 

nuui. coo/ *■ v> in vuxxu 


tSHAZ 


30 


— 


20 


— 


10 


on 


14 


AS*.DS* Width Low 

* & A-/ A AS fl <L V* w * h A-J WW 


















(Read)/AS* Write 


tSL 


240 


— 


195 


— , 


u 




14A 


DS* Width Low (Write) 




115 


— — 


95 


— — 


u 




15 


AS*.DS* Width Hiqh 


tSH 


150 


— 


105 


— 


U 




16 


CLK Hiah to 


















A£?* HS* Hi ah Tmnp^anrp 




— 


80 


— 


70 




A ft 


17 

•X. / 


AS* HS* Hi to R/W Hiah 


tSHRH 


40 


— 


20 


— 


15 


29 


1 ft 
X U 


rr.K Hiah ho R/W* 

V>Xl*\ IJXVJjll l~\J XV/ W¥ 


















H i nh I lUri v i 


i. v> 41 Xvil A 




70 






19 


26 


19 


CLK High to R/W* 


















High (min) 


tCHRHn 


0 




0 




0 


0 


20 


CLK High to R/W* Low 


tCHRL 




70 




60 


15 


25 


21 


Add. Valid to R/W* Low 


tAVRL 


20 




0 




0 


0 


21A 


FC Valid to R/W* Low 


tFCVRL 


60 




50 




4 


5 


22 


R/W* Low to DS* Low 


















(Write) 


tRLSL 


80 




50 




15 


25 


23 


CLK Low to Data Out 


















Valid 


tCLDO 




70 




55 


19 


28 


25 


DS* High to Data Out 


















Invalid 


tSHDO 


30 




20 




-25 


-15 


26 


Data Out Valid to DS* 


















Low (Write) 


tDOSL 


30 




20 




-15 


25 


♦Indicates that the signal is active low. 



Table S-2* Timing Delays for the 68010 (End) 



All units and all emulator-added delays are nanoseconds. 
Numbers 35, 36, 37, 39, 46 and 56 are expressed as clock periods. 









MC68010L8 


MC68010L10 


Emulator i 








8MHz 




10MHz 




Added 


Delays ? 


Numbe r 


• • 

Characteristic 


Symbol 


Min 


Max 


Min 


Max 


Min 


Max 


27A 


Late BERR* Low to 


















Clock Low (setup time) 


tuLLLL 


45 


— 


45 


— 


6.5 


— 


O "7 


uata in to llk low 


















(Setup Time) 


tDICL 


15 


— 


15 


— 


-1 


-2 


0 Q 


Ab w , Ub x Hign to 


















D 1 AC K * Hign 


tbHUAH 


0 


120 


0 


90 


-41 


-20 


O Q 

zy 


ub 7 ^ Hign to uata 


















invaiia inoia iiiue j 


1- c u n t 
toHDl 


0 


— 


0 


— 


-25 


-15 


JU 


Ab * # Db* Hign to 


















BLRR* High 


4- nun nn 

tSHBEH 


0 


— 


0 




-53 


-33 


31 


DTACK* Low to 


















Data In (Setup Time) 


tDALDI 


— 


90 


-- 


65 


-13 


-8 


Jz 


HAL1* and KtibfciT x 


















Input Transition Time 


tRHrt 


0 


200 


0 


200 


0 


0 


33 


CLK High to BG* Low 


tCHGL 


0 


70 


0 


60 


19 


30 


34 


CLK High to BG* High 


tCHGH 


— 


70 


— 


60 


19 


30 


35 


BR* Low to BG* Low 


tBRLGL 


1.5 


3.0 


1.5 


3.0 


18 


28 


Jo 


l$k w Hign to ts(j w Hign 


4- 13 D LI C* LI 


1.5 


3.0 


1.5 


3.0 


18 


28 


37 


BGACK* Low to BG* High 


tGALGH 


1.5 


3.0 


1.5 


3.0 


18 


28 


38 


BG* Low to Bus High 


















Impedance (With AS* High) 


tGLZ 




80 




70 


15 


25 


39 


BG* Width High 


tGH 


1.5 




1.5 




0 


0 


46 


BGACK* Width 


tBGL 


1.5 




1.5 




0 


0 


47 


Asynchronous Input 


















Setup Time 


tASI 


20 




20 




1 


2 


48A 


DTACK* Low to BERR* Low 


tDALBEL 


80 




55 




-1 


-2 


53 


Data Hold from CLK High 


tCHDO 


0 




0 




19 


30 


55 


R/W* to Data Bus 


















Impedance Change 


tRLDO 


30 




20 




0 


0 


56 


Hal t/RESET* Pulse Width 


tHRPW 


10.0 




10.0 




0 


0 


* Indicates that the signal is active low. 



68000/68010 SUPPLEMENT (KSE-5540-02) 



A1-A23 




5TFTR (Note 4) 



The circled numbers refer to Table S-2, where the same 
numbers are used to identify the signals shown in this 
timing diagram. Timing measurements are referenced to 
and from a low of 0.8 volts and a high of 2.0 volts. 

Note 1: Setup times for BGACK, IPL0-IPL2, and VPA 
guarantee their recognition at the next falling edge of 
the clock. 

Note 2: BR must fall at this time to ensure recognition 
at the end of this bus cycle. 



Figure S-6. 68010 Read Cycle Timing 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



CLK 



A1-A23 



AS 



UDS/LDS 



R/W 



Data Out 



FC0-FC2 



Asynchronous 
Inputs 



HALT, RESET 



P 



OTACK 



8EFTS (Note 3) 



6A> 



(20> 



eoA- 



55> 



(32 




r-<2>- 



■^-(47)-^ 



-0- 



©■ 



-0- 



-(48) » j « (2W)-» 

I3 S 



MS). 



p 



(30> 



r 



The circled numbers refer to Table S-2, where the same 
numbers are used to identify the signals shown in this 
timing diagram. 

NOTE: Timing measurements are referenced to and from a 
low of 0.8 volts and a high of 2,0 volts. 



Figure S-7. 68010 Write Cycle Timing 
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A complete emulator system is delivered with all boards in the 
correct configuration for the microprocessor being emulated; 
therefore, you do not have to configure a new emulator. This 
section describes the jumper and switch settings for the 
68000/68010^ emulator personality for reference f or for use when 
changing emulator personalities. Customization to suit your 
target begins with section 2.7. 



2.1 INTERFACE PROCESSOR SflMQ (23Q2-477Q? 

The 2302-4770 static RAM Interface Processor (IP) board is 
described in this section. The earlier dynamic RAM IP board 
version 2302-4722 is described in section 2.2. Support for the 
2302-4722 board is limited to those units already existing in 
the field. 



2.1.1 PROGRAMMABLE COMPONENT 

The 2302-4770 IP board has a programmable 2764 PROM at U10 which 
boots up the system and runs an internal diagnostic program to 
check operational status. This firmware may need to be changed 
with updated software. Currently, for VI. 3 or lower f the 0.0 
version 2764 PROM is used. For V2.0 or higher , the 1.0 version 
2764 PROM is used. 



2.1.2 • MEMORY MAPPING RAMS 

U74 and U75 must be removed. D74 and U75 are the write-protect 
and internal/external memory mappers. Depending on the 
microprocessor used, the write-protect function may be assumed by 
components located on the personality board, or by components on 
the simulation memory boards. The simulation memory board must 
be in the 26-bit mode. (See section 2.3). The required software 
level is at V3.0 or higher for ADS, V2.0 or higher for KDS, V2.0 
for the Emulator Bridge, and VI. 0 for the KPI. 
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68000/68010 SUPPLEMENT 



(KSE-5540-02) 



INTERFACE PROCESSOR BOARDS - 



2.1. 3 BOS TIME-OUT STRAPPING 



The bus time-out piggyback board of the 230 2-4722 dynamic RAM IP 
board (discussed in section 2.2,3 of this document) , has been 
incorporated into the 2302-4770 static RAM IP board as a jumper 
bank, ER1 on the IP board provides the following timing 
options: 

3 and 4 Historical setting f duration 10 microseconds , 
no longer used, 

3 and 1 Bus time-out inhibited at all times, 

3 and .5 Normal bus time-out setting (aToout 1 second) . 

The bus time-out setting of 1 second (3 and 5) is recommended for 
normal operation. The inhibited selection can be used for 
periods greater than 1 second; however , a Target System Check 
occurs after about 4 seconds. 



2.2 INTERFACE PROCESSOR (23Q2-4722? 

The earlier version of the Interface Processor (dynamic RAM IP) 
board has four programmable components that may be updated each 
time the software level is updated. This board also uses a bus 
time-out piggyback board. 



2.2.1 EPROM 

LR1 through LR4 configure the EPROM sockets for U8-U11. They are 
currently . configured for 2732s, A jumper is placed on pins 2 
and 3 and a jumper is placed on pins 4 and 5 for each socket. 



2.2.2 MEMORY MAPPING RAMS 

U66 and U67 must be removed. U66 and U67 are the write-protect 
and internal/external memory mappers respectively. Depending on 
the microprocessor used, the write-protect function may be 
assumed by components located on the personality board, or by 
components on the simulation memory boards. The simulation 
memory board must be configured in the 26-bit mode. (See 
section 2.3). 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



- BUS TIME-OUT & IP FIRMWARE 



2.2.3 BUS TIME-OUT BOARD 

The bus time-out board is a piggyback board (2302-4768) which is 
designed to provide flexible bus time-out control for the IP. 
The dynamic RAMs on the 2302-4722 IP board are replaced with new 
static RAMs located on the piggyback board f and a strap 
selectable timer is provided for the user. The piggyback board 
eliminates a contention problem between the IP f s need to refresh 
its internal dynamic memory, and external target processes. In 
addition f the bus time-out control circuitry gives the user the 
option to extend or inhibit the bus access time. 

The strap ER1 located on the piggyback board provides the 
following timing options: 



BBl setting 

3 and 4 



Explanation 

Original bus time-out of 

10 microseconds — DO NOT USE, 



3 and 1 



Bus time-out inhibited at 
all times 



3 and 5 



Normal bus time-out (about 
1 second) — Recommended. 



The extended bus time-out of 1 second is recommended for most 
systems. The inhibited selection can be used for periods 
greater than 1 second; however, a Target System Check occurs 
after about 4 seconds. 



2.2.4 IP FIRMWARE 

The emulator software must be matched with the firmware on the IP 
board. The following list shows the programmed components of 
the IP board f which are compatible with V2.5 software. The 
component may bear either the actual part number or the shortened 
"CHIPS" number. 



SOCKETS 



PART HHMEEE 



CHIPS 



Ull 
U9 
U8 
U10 



2302-4005-02/05 
2302-4006-02/05 
2302-4007-02/05 
2302-4008-02/05 



V2.5-0 
V2.5-1 
V2.5-2 
V2.5-3 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



SIMULATION MEMORY - 



For version 3.0 and higher software: 



sockets part mmm sexes 

Ull 2302-4005 V3.0-0 

U9 2302-4006 V3.0-1 

U8 2302-4007 V3.0-2 

U10 2302-4008 V3.Q-3 



2.3 SIMULATION WQKL 2QMD& 

Up to four memory boards may be installed in the emulator. ER2 
must be strapped differently on each installed board to 
differentiate between them. The memory boards are designed for 
20-bit mode or 26-bit mode simulation memory operation. 

Optional memory banking is available only on the KDS host systems 
and requires software V2.0 or higher. 



2.3.1 SIMULATION MEMORY BANKING BOARD 

The simulation memory banking board (2302-4772) is designed to 
operate in memory banking mode or in regular simulation memory 
mode without the memory banking option. 

For the 68000/68010 , configure the simulation memory banking 
board (2302-4772) for 26-bit mode; set ER1 at 1 and 2. See 
Figure S-8. 

Memory banking is discussed in the KSE Series Slave Emulator 
Hardware Reference Manual, (KSE-5500) • It is not explained in 
the 2302 Series Slave Emulator Hardware Reference Manual (2302- 
5003) f because the memory banking option is not available with 
the 2302 series equipment. 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



STATIC MEMORY - 



2.3.2 26-BIT STATIC MEMORY (2302-4724) 

This is an earlier version simulation memory board* This section 
is included for customers who have existing units in the field. 
This board is no longer supplied. 

The 26-Bit static memory board can be configured to function as a 
20-bit f or 26-bit memory. Correct placement of jumpers on ER1 
is the controlling factor. For the 68000/68010 , 26-bit 
operation is required. 26-bit memory operation is obtained by 
jumpering pins 1 and 2 on ER1 for version 2.5 software or later. 
See Figure S-9. 

ER2 must be strapped differently on each installed memory board 
to differentiate between them. ER3 is for testing only and 
should not be used. 



Figure S-9. 26-Bit Static Memory Jumpers 



68000/68010 SUPPLEMENT (KSE-5540-02) 



BUS ANALYZER & BREAKPOINT BOARDS 



2.4 BUS ANALYZER J3QARB (23Q2-4746? 

The bus analyzer does not require configuration jumpers , and 
connects through two edge connectors. The short 26-pin 
connector flat ribbon cable connects to P3 of the analyzer and 
P3 of the personality board. The cable from the back panel with 
two 26-pin connectors on it plugs to P5 of the bus analyzer and 
P5 of the breakpoint board. (See Figure S-13, where these 
cables are identified as cable G and cable B respectively.) 



2-5 BREAKPOINT BOARD (REVISION SI 

The DIP switch , SW1 should be set with all four positions open 
for the 68000/68010. Figure S-10 shows the location of this DIP 
switch on the breakpoint board. 



Figure S-10. Revision E Breakpoint Board DIP Switch 
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68000/68010 SUPPLEMENT (KSE-5540-02 ) 



DIP SWITCH & JUMPER SETTINGS 



2.6 PERSONALITY £QARB EXE SWITCH CONFIGURATIONS 

The emulator identifies the personality board type and hardware 
version by reading a version I/D byte on the board* The version 
I/D byte is set by the DIP switch on the personality board* 

There are three possible switch settings on the 68000/68010: for 
the 68000, for the 68000 in word mode f and for the 68010 
processors* These settings are as follows: 



Personality 
Switch Settings 



ppsition 


$8000 


68000 


68010 










l 


Closed 


Closed 


Closed 


2 


Open 


Open 


Open 


3 


Closed 


Closed 


Closed 


4 


Closed 


Open 


Open 


5 


Open 


Closed 


Open 


6 


Closed 


Open 


Open 


7 


Closed 


Open 


Open 


8 


Closed 


Closed 


Closed 



2.7 EMULATOR BQMH jffiMEEE SETTINGS 

There are four jumper banks on the emulator probe board (2302- 
4780). To access these jumpers the probe housing has to be 
disassembled. 

1* Remove the four Phillips screws on each side of the 
housing f below the vents. 

2. Turn the probe box upside down. 

3. Remove the four Phillips screws on the bottom of the 
housing. 

4. Lift off the cover. 

The component side of the board is now exposed. 



S-24 



68000/68010 SUPPLEMENT (KSE-5540-02) 



- JUMPER SETTINGS 



Figure S-ll shows the locations of the jumper banks , ERl selects 
the number of wait states, ER2 changes the clock frequency 
setting. Jumper banks ER3, ER4, and ER5 work together in data 
bus and address bus buffer timing. Their settings determine if 
all cycles or only external cycles reach the target system, 

jumpers setting Function 



ERl 


1 


and 


5 


No wait states 




2 


and 


6 


1 wait state (Recommended) 




3 


and 


7 


2 wait states 




4 


and 


8 


3 wait states 


ER2 


1 


and 


2 


10 MHz (Recommended) 




3 


and 


2 


5 MHz 


ER3 


1 


and 


2 


Allows test memory cycles, 



ER4 memory cycles , and external cycles to 

ER5 the target system. Recommended setting, 

ER3 2 and 3 Allows only external cycles to the 

ER4 target system, 

ER5 



Figure S-ll. Emulator Probe Board 
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68000/68010 SUPPLEMENT (KSE-5540-Q2) 



PROBE CLOCK & FAST RAM - 



2*8 EMULATOR £RQM CLOCK FREQUENCY SELECTION 

The emulator probe board (2302-4780) is designed to have a 10 or 
5 MHz clock, generated by a 20 MHz crystal oscillator. This 
frequency is changed by the setting of ER2 on the probe board as 
explained in section 2.7. An 8 MHz clock frequency requires the 
replacement of the 20 MHz crystal with a 16 MHz one. Consult 
Kontron Service Department before changing the installed clock. 



2.9 FAST RAM PIGGYBACK BQABB (23Q2-4781? 

A piggyback RAM board (2302-4781) , with two 4K word blocks of 
fast simulation memory, has been designed for the emulator probe 
board to allow operation without wait states f under all memory 
mapping modes at 10 MHz. See Figure S-12. This is a permanent 
addition to the emulator probe board and plugs into the 
connector Jl. The location of connector Jl is shown in Figure 
S-ll. Connector J2 should not be used. 
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Figure S-12. Fast RAM Piggyback Board 



68000/68010 SUPPLEMENT (KSE-5540-02) 



- PAST RAM 



At 10 MHz, simulation memory accesses from 68000/68010 require 
one wait state* The fast RAM board allows the 68000 to run 
without wait states • The fast RAM board and the simulation 
memory board can co-exist in a single emulator system, but they 
must not be programmed to the same physical address. To achieve 
this, the entire 68000/68010 memory space must be mapped 
externally, so that the memory mapper can be turned off. Also, 
the fast RAM board must be programmed externally* 

Four DIP switch banks, SW1, SW2, SW3, and SW4 are used to program 
the fast RAM board* These switches are on the bottom of the 
emulator probe box; they are labeled and accessible from the 
outside of the probe box, without disassembly. See Figure S-13. 



Figure S-13. Fast RAM Programming Switches 
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68000/68010 SUPPLEMENT (KSE-5540-02) 



PROGRAMMING SWITCHES & MEMORY BLOCK 1 - 



2.10 JEASE SAM PROGRAMMING SWITCHES 

The fast RAM board has two blocks of memory; each memory block is 
4K words, or 8K bytes • SW1 and SW2 control the first 4K block 
of memory , SW3 , and SW4 control the second block* Each block 
can be enabled or disabled independently* 

To enable Block 1, close position 4 of switch SW1. To enable 
Block 2, close position 4 of switch SW3. Both blocks may be 
enabled simultaneously* 

SW1 and SW 2 program the physical address range of Block 1. A 
portion of the address range is shown in Table S-3. 

SW3 and SW 4 program the physical address range of Block 2* A 
portion of the address range is shown in Table S-4. 

The jumper bank ER1 (see Figure S-ll) must have header pins 1 and 
2 connected for 68000/68010 operation. 



Table S-3> Programming Memory Block 1 



0= closed, 1 ~ open 
Addressing itenge SSL Position SSI Position 





3 


2 


1 


8 


7 


6 


5 


4 


3 


2 


1 


X'OOOO'-X'lFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


X^OOO'-X'SFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


XUOOO'-X'BFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


X'SOOO'-X'VFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


X'SOOO'-X'SFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


0 


X'AOOO'-X'BFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


1 


X'COOO'-X'DFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


. 0 


X'EOOO'-X'FFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


1 



* and so forth, until the binary value 11111111111 is 
reached. This value corresponds to the highest 8K bytes 
of the entire 16 megabyte range. 
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68000/68010 SUPPLEMENT (KSE-5540-02) 

- MEMORY BLOCK 1 



Table S-4, Programming Memory Block 2 
0 = closed, 1 = open 
Addressing Range £H2. Position SSSA. Position 





3 


2 


1 


8 


7 


6 


5 


4 


3 


2 


1 


X'OOOO'-X'IFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


X^OOO'-X'SFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


XUOOO'-X'SFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


X'SOOO'-X'VFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


X'SOOO'-X^FFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


0 


X'AOOO'-X'BFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


0 


1 


X'COOO'-X'DFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


0 


X'EOOO'-X'FFFF' 


0 


0 


0 


0 


0 


0 


0 


0 


1 


1 


1 



* 



* and so forth f until the binary value 11111111111 is 
reached. This value corresponds to the highest 8K bytes 
of the entire 16 megabyte range. 
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SECTION 3 



INSTALLATION 



This section provides instructions for changing the installed 
emulator personality. The emulator is configured for a given 
microprocessor at the time of shipment. These instructions are 
intended for users who wish to change the emulator personality 
module and/or support more than one microprocessor in their 
design and development programs. 



3.1 DISASSEMBLING 22Z EMULATOR 

To prevent damage to cables and connectors , mark the pin 1 
position on each connector before removing, or observe that the 
pin 1 end of the connector is on the striped edge of the flat 
ribbon cable. Also note how the flat ribbon cables connect to 
the bottom edge of the connector. It is very important not to 
reverse connector 'and cable directions, otherwise damage to 
cables and components can occur, through reversal of power 
connections. 

Turn the AC power switch of the emulator to OFF. For safety, 
unplug the AC line cord at both ends. 

1. Remove the following cables from the back panel: 

a. Ribbon cables connected to probe I and probe II 

b. Ribbon cables connected to port A and port B 

c. Ribbon cable connected to bus analyzer 

2. Remove the back panel, and lay it down with the cables on 
top. 

3. Remove all internal cables from the edge connectors of 
the personality board currently installed. 

4. Remove the currently installed personality board from the 
emulator. Place thumbs on the board ejectors and pull 
back, rotating the ejectors outward until the board is 
pulled away from the backplane slot. Gently slide the 
board all the way out. See Figure S-14. 
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68000/68010 SUPPLEMENT (KSE-5540-02) 
DISASSEMBLING — 



CAUTION! 



Only one personality board should be installed in the 
emulator at a time. The system does not operate with 
more than one personality board, and there is a 
possibility that the emulator may be damaged. 

INSTALLING INCOMPATIBLE PROBE AND PERSONALITY BOARDS MAY 
CAUSE SEVERE DAMAGE TO THE SYSTEM. 
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Figure S-14. Removing the Personality Board 
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INSTALLATION AND REASSEMBLY 



3.2 INSTALLING JH£ PERSONALITY BOARD 

On the new 68000/68010 personality board f check the DIP switch 
and verify that the switch positions are as listed in 
section 2.6. 

Install the 68000/68010 personality board in the emulator in the 
same slot that the previous personality board occupied. The 
recommended configuration is with the personality board in the 
middle of the cardcage, and next to bus analyzer board if a bus 
analyzer board is part of the system. Personality board 
connector P4 goes to probe connector I, P5 connector goes to 
probe connector II on the back cover of the emulator case. 
Personality board connector P3 connects to P3 on the bus 
analyzer, through a short ribbon cable. Make sure that the 
board is locked in place. See Figure S-15. 



3.3 REASSEMBLING SHE EMULATOR 

1. Check to see that the simulation memory board(s), if any, 
are compatible with the 68000/68010 as explained in 
section 2.3 of this supplement. 

2. Check to be sure that U74 and 075 (or U66 and U67 with 
the earlier version IP board 2302-4722) are removed from 
their sockets on the IP. See section 2.1.2 for the 2302- 
4770 board, or section 2.2.2 for the 2302-4722 board. 

3. Check to see that all internal cables are securely and 
correctly installed. Make sure that there are no 
reversed connectors. There are ribbon cables connected 
to probe I and probe II from P4 and P5 respectively, of 
the personality board. There are ribbon cables to port A 
and port B ' from the IP board. If the optional bus 
analyzer board is present, P3 of the bus analyzer 
connects to P3 of the personality board, and P5 of the 
analyzer connects to P5 of the breakpoint board. See 
Figure S-15. 

4. Replace the back panel and secure it in place. 

5. Replace the AC line power cord to the emulator and turn 
the switch ON. The emulator is now configured for the 
68000/68010 personality board. 
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3,4 CONNECTING JQ THE TARGET SYSTEM 

The emulator is connected to the target system through the 
emulator probe* The 64-pin plug at the end of the ribbon cable 
leading from the emulator probe is plugged into the target 
system's 68000/68010 socket* The header pins on the plug are 
fragile f so use extra care when plugging into the target system. 
However r the pins are part of an adapter and the adapter is easy 
to replace if the pins are damaged* The Kontron part number for 
the adapter is 4220-5752. It is manufactured by Aries as part 
number 1 ,106 , 126-2H. It is recommended that the user have a 
supply of spare adapters on hand, to prevent unplanned 
interruptions due to broken adapter pins. 

If the adapter must be replaced, make sure that the thicker pins 
are plugged into the probe connector, and the thinner pins are 
plugged into the target system connector. The notch on the 
adapter should be lined up with pin number 1, and pin number 1 
of the adapter should be plugged into pin number 64 of the plug. 



3.5 SOFTWARE/ FIRMWARE 

The emulator executive software must be matched with the firmware 
(the EPROMs) on the Interface Processor board in the emulator. 
Verify the software version number with the firmware version 
number, as indicated in section 2.2.4. For the 2302-4722 IP 
board, see section 2.1.1. If you cannot verify the 
configuration of your system, check with the Kontron Customer 
Service Department. 

You are now ready to begin emulation or development. Refer to 
the 68000 Debugger Manual (KSE-5040) for complete instructions. 
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THEORY OF OPERATION 



Microprocessor emulators allow the user to externally control the 
microprocessor by forcing it to execute special emulation 
software programs (called test programs) . These programs access 
the internal state of the microprocessor , then alter or restore 
it f resulting in such control functions as displaying and setting 
of memory or register contents . 

The 68000/68010 Emulator Subsystem consists of two 
microprocessor specific components which adapt the common 
emulator architecture to the 68000/68010 emulation: the 
68000/68010 emulator probe and the 68000/68010 personality board. 

The 68000/68010 emulator probe contains a 68000/68010 
microprocessor , plus buffering and clock functions that must be 
located near the target system's 68000/68010 socket. The probe 
is connected by ribbon cables to the 68000/68010 personality 
board. The block diagram for the 68000/68010 probe is given in 
Figure S-16. 

The personality board is installed in the emulator backplane. 
The personality board contains an interface to the emulator bus f 
execution breakpoint qualifying logic , and special memory and 
sequencers that allow the emulator to control the 68000/68010 
microprocessor. The block diagram for the 68000/68010 
personality is given in Figure S-17. 



4.1 68QQQ/S8Q1Q SYSTEM OPERATION 

The 68000/68010 microprocessor in the emulator probe operates in 
one of three states at any given instant: 

1. Target program execution 

2. IP/emulator bus access 

3. Test program execution 

Each of these states is described in a following subsection. 
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OPERATION STATES & CONTROL TRANSFERS 



4.1.1 TARGET PROGRAM EXECUTION 

In this state, the 68000/68010 executes the target program. 
Memory accesses are directed to target system memory or to 
simulation memory, according to the selected configuration of 
memory mapping* Target program execution proceeds until 
conditions require that the emulator take control of execution. 



4.1.2 IP/EMULATOR BUS ACCESS 

In this state, execution is suspended on a cycle-by-cycle basis 
so the Interface Processor (IP) can gain access to the emulator 
bus. The IP board accesses devices on the breakpoint, bus 
analyzer, personality, and simulation memory boards. 



4.1.3 TEST PROGRAMS EXECUTION 

In this state, the emulator forces the microprocessor to execute 
test programs. These programs access, and then alter, or restore 
the internal state of the microprocessor. 

Test programs reside in test memory (see section 4.3.2). 



4.2 TRANSFERS 

The conditions and means of transferring control of execution 
between the target and the emulator are discussed in the 
following subsections. 



4.2.1 TARGET PROGRAM TO TEST PROGRAM 

The 68000/68010 is forced to execute test programs at the 
following times: 

1. When power is applied to the emulator 

2. When the emulator is reset 

3. When a breakpoint condition is detected 

4. When a snapshot condition is detected 

5. To satisfy a user request (display, store, halt, single 
step, interrupt) 
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CONTROL TRANSFERS 



Under any of these conditions, the emulator begins a sequence to 
take control of the 68000/68010 . The transfer of control from 
the target program to test programs is controlled by a state 
machine called the sequencer. This process is called capture. 
The sequencer's capture operation is described in detail in 
section 4.3.1.1. 

Typically, when a snapshot occurs or a display update is 
requested while the target program is executing, several test 
programs are run in succession. Target program execution is in 
this case allowed to continue (the test program triggers the 
sequencer return sequence) between the time that each test 
program completes, and the time that the IP loads and requests 
execution of the next test program. This helps to minimize the 
impact upon realtime execution. 



4.2.2 TARGET PROGRAM TO IP 

This transfer is done in response to a user command (such as the 
setting of new breakpoint parameters while the target program is 
executing) . It is handled by the 68000/68010 bus request and/or 
bus grant. The 68000/68010 bus request and bus grant signals 
are handled by special logic to allow both the emulator and the 
target system to use these functions. 



4.2.3 TEST PROGRAM TO TARGET PROGRAM 

When the test program completes its function (fetching a block of 
memory for example), it signals its completion to the IP. It 
does this by executing an instruction at a special location in 
test memory. This triggers an Emulation Processor Interrupt to 
the Z80 processor on the IP board. Then the test program 
determines if 'the IP has requested it to return to target program 
execution, or to wait in test program execution state. 

If a return to target program execution has been requested, the 
return sequence is as described in section 4.3.1.2. 

If a wait in test program execution state has been requested, 
the test program executes a jump-to-self loop until the IP 
requests it to execute another test program. Then the IP 
changes the jump-to-self instruction into a jump to the start of 
a new test program. 
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HARDWARE & SEQUENCER DESCRIPTIONS 



4.3 HARDWARE DESCRIPTION 

Several areas of the emulator hardware are described in the 
following sections ♦ These descriptions are intended to aid 
understanding of the 68000/68010 emulator at a functional level. 
References to specific gates and internal timing details are 
omitted. The following sections of logic are described: 

1. Sequencer - controls test program execution, 

2. Test memory - contains test programs and IP 
communication buffer. 

3. Execution breakpoint qualifiers - additional 
qualification to suppress side effects of 68000/68010 
instruction prefetch. 



4,3*1 SEQUENCER DESCRIPTION 

The sequencer transfers control of the 68000/68010 microprocessor 
between target program execution and test program execution. It 
also controls the 68000/68010 when the emulator is powered up or 
reset, ' 

The sequencer is a state machine with 11 inputs f three outputs, 
and a four bit state register. The input signals are: 

1019 Control line 1019 from the IP board. This signal is 

asserted by the IP to force the transition from 
running the target program to running a test 
program. 

1018 Control line 1018 from the IP board. This signal is 

identical to 1019 in resulting sequencer action, but 
is used during the single step sequence in 
conjunction with a single step test program. 

BPn (n = 1,2,3,4) The four breakpoint conditions. 

These are asserted when the corresponding breakpoint 
(0,1,2,3) condition is detected by the breakpoint 
board. These also cause a transition from running 
the target program to running a test program, 

I7ACK* Interrupt Level 7 Acknowledge. This signal is 
asserted by logic on the personality board when it 
detects a level 7 Interrupt Acknowledge cycle from 
the 68000/68010. This is used to synchronize the 
capture sequence, as described later. 
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RTE* Return From Exception* This signal is asserted by 

logic on the personality board when the RTE 
instruction ending a test program is executed. This 
triggers the return to executing the target program* 

AHALT- This signal is asserted when the 68000/68010 is 
temporarily halted because of a bus grant for target 
system DMA or for IP access to the emulator bus* 

1017 Control line 1017 from the IP board* This signal is 
asserted by the IP during the initial reset sequence 
to forcibly enable test memory (causes TME* output 
of sequencer to be asserted) . 

CMDRST Asserted during a hardware reset of the emulator* 



The sequencer outputs are: 

IPL7* Commands probe logic to assert a level 7 (non- 
maskable) interrupt request to the 68000/68010. 



STKEN* Stack Enable. Forces special circular buffer 
addressing for test memory. Duplicates memory write 
cycles into circular buffer. This is used to 
capture the stacked Program Counter and Status 
Register when the emulator's level 7 interrupt is 
acknowledged by the 68000/68010. 

TME* Test Memory Enable. Directs to test memory all 

memory reads and writes , within addresses covered by 
enabled banks of test memory , without those memory 
cycles being .visible to the target system. 



4. 3 ,1.1 Capture Sequence 

1. To make the transition from executing the target program to 
executing a test program, the sequencer gains control of the 
68000/68010 by a level 7 (non-maskable) interrupt. This is 
triggered by asserting the IPL7* output of the sequencer. 
To insure that the 68000/68010 recognizes the emulator's 
level 7 interrupt request, even if the processor's interrupt 
level is currently 7 , the 68000/68010 1 s Interrupt Priority 
Level (IPL) signals are first brought to a value of 0, then 
to a value of 7, by additional logic on the personality 
board and probe. 
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The sequencer asserts STKEN* at the same time that it asserts 
IPL7*. This causes all memory writes to be duplicated into 
a special circular buffer area of test memory. The circular 
buffer function is implemented by holding the upper bits of 
the test memory address constant and passing A2 and Al from 
the 68000/68010 to the corresponding test memory address 
bits. This provides a 4 word (8 byte) area f which is 
sufficient to capture the Program Counter and Status 
Register values pushed by the 68000/68010 during the level 7 
interrupt response sequence. 

2. When the 68000/68010 recognizes the level 7 interrupt f it 
first stacks the low word of the Program Counter. The exact 
timing of this stack write is not predictable in relation to 
the interrupt request , and cannot be distinguished from any 
other write cycle. Therefore , the emulator must allow this 
first stack write cycle to write both to test memory and to 
target or simulation memory (as mapped) . 

Because of this f the Supervisor Stack Pointer must always be 
pointing to an area of memory (target or simulation) that 
works well enough to return a DTACK (data acknowledge) . If 
it does not, after 1 second the missing DTACK will trigger a 
timeout on the personality board f which asserts a bus error 
condition to the 68000/68010. 

3. The 68000/68010 then performs a level 7 Interrupt Acknowledge 
cycle. 

4. Logic on the personality board detects the level 7 Interrupt 
Acknowledge cycle, and asserts I7ACK* to the sequencer. 

5. The sequencer then asserts both STKEN* and TME*. This 
causes memory writes to be directed to the special stack 
buffer in test memory, and directs all cycles to test memory 
(the cycles are not be seen by the target system) . 

6. Logic on the probe forces an auto-vector type interrupt 
acknowledgement by asserting VPA- to the 68000/68010 during 
this cycle. 

7. The 68000/68010 next pushes the Status Register and high 
word of the Program Counter to the Supervisor stack. These 
write cycles are captured in the special test memory stack 
buffer and are not seen by the target system. 
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8. After both stack writes have been detected by the sequencer, 
it negates STKEN*, but leaves TME* asserted. This directs 
all memory accesses within the range X 1 000000 1 to X'OOOTFF 1 
to test memory , without being seen by the target system. 

9. The 68000/68010 next fetches the interrupt 7 auto-vector from 
location X r 7C ! in test memory, which has been initialized by 
the IP to point to the entry point of a test program. 

Test program execution continues from this point. 



4.3 # 1«2 Return Sequence 

To make the transition from executing a test program to running 
the target program (see section 4.2.3): 

1. The test program first restores all registers to their 
original (or intentionally altered) values. 

2. It then returns to the target program by executing an RTE 
(Return from Exception) instruction. This causes the 
68000/68010 to pull the Program Counter and Status Register 
from the Supervisor stack and resume execution'. 

3. Logic on the personality board asserts RTE* to the sequencer 
when it detects an access to the test memory location 
containing the RTE instruction. 

4. The sequencer tracks the RTE sequence, and forces the stack 
read cycles to be from the circular stack buffer area of 
test memory by asserting STKEN*. 

5. The sequencer then negates both STKEN* and TME* just before 
the next instruction fetch cycle. 

This re-enables target system and simulation memory access and 
completes the return to target program execution. 
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4.3.1.3 Sequencer State Assignments for the 68000 

The 68000 sequencer's state machine uses 10 states* The 
functions of the states are listed below, and shown in Figure 
S-18: 



State Function 

0 Hardware reset state 

7 Return sequence - discard prefetch cycle 

5 Return sequence - pop SR 

4 Return sequence - pop low word of PC 

C Return sequence - pop high word of PC 

D Target program execution 

1 Capture sequence - capture low PC push f 

wait for level 7 interrupt acknowledge 

3 Capture sequence - capture SR push 

2 Capture sequence - capture high PC push 

6 Test program execution 



A. 3 .1.4 Sequencer State Assignments for the 68010 

The 68010 sequencer's state machine uses 12 states. The 
functions of the states are listed below, and shown in Figure 
S-19: 



State Function 

0 Hardware reset state 

7 Return sequence - discard prefetch cycle 

5 Return sequence - pop SR 

4 Return sequence - pop PC offset 

C Return sequence - pop PC PCH 

8 Return sequence - pop PC PCL 
D Target program execution 

1 Capture sequence - capture low PC push, 

wait for level 7 interrupt acknowledge 

3 Capture sequence - capture low PC push 

2 Capture sequence - capture SR push 

A Capture sequence - capture high PC push 

B Capture sequence - capture offset push 

6 Test program execution 
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Figure S-18. Sequencer State Diagram for 68000 
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[wait for pcl PUSH AND INTERRUPT 7ACK] 



Figure S-19. Sequencer State Diagram for 68010 
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4. 3 .2 TEST MEMORY 

Test memory is 1024 16-bit words (2K bytes) of RAM located at 
addresses X'OOOOOO 1 to X'OOOTFF 1 . The memory and its addressing 
logic reside on the personality board. Test memory contains the 
executable 68000/68010 code for test programs, and functions as a 
communications buffer for the Z80 processor on the IP board. 

It is divided into two 512 word banks. These can be 
individually enabled and disabled under IP or test program 
control. Both banks of test memory are disabled when the target 
program is executing. When a bank of test memory is disabled, 
memory accesses in that bank's area are directed to target or 
simulation memory (depending upon the selected memory mapping) . 

Both banks are usually enabled when a test program is executing. 
When a bank of test memory is enabled, memory accesses within 
that area are directed to test memory, and are not visible to the 
target system. 

If a test program needs to access target or simulation memory at 
an address within a bank of test memory, it jumps to a routine 
in the opposite bank. The routine in the opposite bank disables 
the test memory bank covering that specific address, access 
target or simulation memory, then re-enables the bank of test 
memory. This banking scheme allows selective access to the 
target system (or simulation) memory by the test programs in the 
same address range as test memory. 



4.3.3 EXECUTION BREAKPOINT QUALIFIERS 

The emulator breakpoint logic examines the 68000/68010 1 s bus 
cycles and determines if a cycle matches a breakpoint condition. 
If the breakpoint condition is data or "don't care", the 
breakpoint match condition is returned directly to the breakpoint 
counter and combination logic. However, if the breakpoint is an 
instruction breakpoint, there is an added complication due to the 
68000/68010 1 s special characteristics. 

The 68000/68010 microprocessor prefetches instructions, and can 
prefetch an instruction word that is never executed (because of a 
preceding branch, call, or return instruction). Also, the 
68000/68010 does not distinguish the fetch of the first word of 
an instruction from the fetches of additional words by external 
control signals. This improves the performance of the processor, 
but complicates the emulator's task. Instruction breakpoint 
match conditions must be sequence-filtered by the execution 
breakpoint qualifiers on the personality board. 
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There are four identical qualifier circuits - one for each of the 
four breakpoints. Each qualifier receives a breakpoint match 
condition from the comparators on the breakpoint board and 
returns a qualified match condition to the corresponding counter 
and combination logic on the breakpoint board. The qualifiers 
are only enabled for instruction breakpoints. When a qualifier 
is not enabled f the breakpoint match condition is returned 
directly to the counter and break logi 

The breakpoint address comparator RAMs on the breakpoint board 
are usually programmed so that one address produces a match 
condition* Each comparator RAM examines an 8-bit slice of the 
address bus. The match condition output is obtained by ANDing 
the outputs of all comparator slices. 

For instruction breakpoints, the address comparators are 
programmed so both locations N and N+2 produces a match 
condition. In this case, the upper slices are each programmed to 
match in only one location f with the lowest slice matching in two 
locations. The comparator will match properly , to N and N+2 
only. The qualifier logic for each breakpoint asserts its output 
if two consecutive instruction fetch cycles are tagged with a 
match condition for that breakpoint. 

The execution breakpoint qualifier logic assumes that if an 
instruction execution breakpoint is placed on address N, and 
actually executed f then the 68000/68010 will fetch instructions 
in the sequence (N, N+2) , with no instruction fetches between N 
and N+2. (Intervening data fetches or stores for operands are 
allowed. ) 

The double match programming of the comparator RAMs and the 
execution breakpoint qualifier logic place restrictions on 
allowable breakpoint addresses in two cases. 

The first restriction: 

If N and N+2 differ in the upper bits, the comparator RAMs will 
perceive a number of different locations as matching. 

For example, if a breakpoint were set at location 1234FE, then 
123400 and 123500 would be programmed. Then a jump instruction 
(or a JSR register indirect instruction) at location 1234FC to 
123400 would cause an inaccurate breakpoint. Also, instructions 
RTS , RTE , and RTR will fall under this same multiple address 
matching problem, whenever the addresses N and N+2 differ in the 
upper bits. 



S-50 



68000/68010 SUPPLEMENT (KSE-5540-02) 



BREAKPOINT QUALIFIERS & TARGET SYSTEM CHECKS 



The second restriction: 

If a conditional branch instruction precedes a one-word 
instruction, and conditionally branches around that one-word 
instruction to the instruction immediately following, then the 
68000/68010 will make instruction fetches in the sequence (N f 
N+2) (where N is the address of the one-word instruction) whether 
or not the one-word instruction is actually executed. Thus, if 
an instruction breakpoint is placed on the one-word instruction, 
the breakpoint will be taken even if the instruction was branched 
around and not executed* The following code fragment 
illustrates : 



Address 

N-2 

N 

N+2 



BEQ 
ADD 

SKIP SUB 



Operand Explanation 

SKIP May skip next instruc- 

tion 

D0,D2 Prefetched, but may not 

be executed 

D4,D0 Executed, creating il- 

lusion that instruction 
at N was executed 



4.4 CAUSES QE TARGET SYSTEM CHECK 

A Target System Check occurs whenever a requested test program 
has not completed within 4 seconds. Typical causes of this are: 

1. Incomplete or very slow memory cycle (Address Strobe not 
negated within 1 to 4 seconds of assertion) . 

2. Incomplete bus arbitration sequence (DMA device failed 
to assert or to negate BGACK to 68000/68010) . 

3. Power not applied to target system. 

4. Clock malfunction in target system. 

5. Target system reset line asserted for a long period. 

6. Multiple, nested exceptions resulting in a hard halt of 
the 68000/68010, 

7 • Memory in interrupt vector area missing, malfunctioning, 
or not properly initialized (this can cause nested 
exceptions and hard halts) . 
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DOCUMENTS — 

4.5 RELATED DOCUMENTS 

For additional information on the material presented in this 
chapter, the reader is also referred to the following documents: 



1. 


KSE-5040 


68000 Debugger Manual 


2. 


KDS-5010 


The Kontron Assembler 


3. 


KDS-5011 


The Kontron Linker 


4. 


PAS- 50 10 
or 

KPR-5050 


68000 Pascal User's Manual 
Kontron Pascal Reference 


5. 


KSE-5140 


MC68000 Microprocessor User's 


6. 


KDS-5000 


CP/M Utility Manual 


7. 


KDS-5100 


Osborne CP/M User Guide 
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EMULATION APPLICATION NOTES 



The following are detailed notes on 68000 and 68010 
microprocessor emulation. 

1. To gain control of the Emulation Processor (EP) during 
execution of user code, the emulator uses the 68000/68010 
level 7 auto-vectored interrupt. If the 68000/68010 fails 
to respond to the level 7 interrupt , a "Target System 
Check" results. The emulator will not recover from errors 
in code or hardware which result in a non-functioning 
68000/68010. 

Example: Suppose low-order-byte memory has been mapped to 
target memory. However f suppose also that target memory is 
malfunctioning: the least significant bit of data read from 
memory is always a 1. The target program, running in 
properly functioning memory in another area, encounters an 
exception condition, perhaps zero divide. Because of the 
failure of low memory, the value of the zero divide vector 
is odd. This causes an address error. Because the address 
vector is also misread as an odd value, the 68000/68010 
enters a hard halt state, from which it can't respond even 
to the level 7 interrupt request from the emulator. This 
results in a Target System Check condition. 

2. The target system should not be powered down when the 
external clock is enabled. When enabled, the external clock 
is used for internal operations; if the target system clock 
is shut off, equipment failure or a Target System Check 
results. 

3. If the external clock (target system clock) is enabled, and 
the EP does not find a valid clock signal within 600 
nanoseconds, then the EP overrides the external clock enable 
command and uses the internal clock. The user is informed 
of this condition with the following message: 

"Bad target system clock — using internal clock 11 

4. Breakpoints using the INSTRUCTION parameter are intended to 
halt execution when the instruction at the specified address 
is executed. However, one additional instruction, past the 
desired breakpoint, may be executed before the breakpoint 
occurs. 
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68000/68010 SUPPLEMENT (KSE-5527-02.) 



NOTES 



5. The effects on the target system of entering and executing 
68000/68010 test programs are as follows: 

a. For 68000 only: during test program execution, the 
low word of the Program Counter (PC) is written onto 
the user's supervisor stack , and then pulled off. 
It is important that the user be aware of this in 
order not to upset some special use of the stack by 
this process. 

b. For 68000 and 68010 both: the level 7 interrupt is 
used by the personality board during test program 
entry, and no interrupts are allowed during test 
program execution. Because interrupts remain 
pending in 68000/68010 systems, the only limitation 
is the time required to service these interrupts, 
due to test program intervention. The emulator 
presents its level 7 interrupt sequence as follows: 
the 68000/68010 IPL lines are brought to a value of 
zero and then brought to a value of 7. This ensures 
that the emulator can gain control during a user's 
level 7 interrupt service, if necessary. 

c. When accessing the first 512 words of target memory 
(internal or external) during test program 
execution, if a bus error occurs the 68000/68010 
will jump to the user's bus error vector, not the 
emulator's. Therefore, the user must have a device 
responding to the first 512 words of the address 
space. In addition, the user must have a routine to 
handle a bus error interrupt. 

d. All four execution breakpoints will not execute 
properly on a branched around instruction that is 
only one word long. Execution breakpoints imply a 
"don't care" condition on data, and they work on 
addresses only. 
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